Private_key_jwt

As explained in Secure APIs

private_key_jwt is a client authentication method in which a client signs a one-time-use JWT with a previously registered private key.

private_key_jwt authenticates a confidential client by having it sign a new, one-time-use JWT with a private key previously registered with the authorization server. The client sends that assertion when requesting tokens. section 10.4

Figure 10.6 Public clients run in the user agent, and their code is exposed, so they can’t store credentials to authenticate with the authorization server. Confidential clients run on a server, and their code isn’t exposed, so they can store credentials with which they authenticate with the authorization server.

Use the public-versus-confidential-client distinction to see why private_key_jwt belongs on a server that can protect private credentials, not in exposed browser code. section 10.4

Token request

A form-encoded token request can contain grant_type=authorization_code, the authorization code, client_id, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, and client_assertion=<self-signed-jwt>. The assertion is freshly signed for that request and proves control of the registered key. section 10.4

How Secure APIs covers it

How deep it goes

Defines the method and shows its token-request payload, but does not detail JWT claims or key-registration procedures.

Examples

Uses an application/x-www-form-urlencoded authorization-code token request containing a self-signed JWT assertion.

What it assumes

Assumes a confidential client and a private key previously registered with the authorization server.

What you can do after

Apply private_key_jwt to authenticate a confidential client during token acquisition.

How it connects

Connects client authentication with confidential clients, authorization servers, JWTs, access tokens, and mutual TLS.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.